chore: pin GitHub Actions to commit SHAs - #345
Conversation
- Pin all eight action references to verified upstream commits. - Document how to maintain action pins and their version comments. Refs #344
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (5)Verify that README changes match actual CLI/TUI behavior and that Currently Implemented Features, TUI Key Bindings, Usage, and Configuration content stay aligned with code changes.⚙️ CodeRabbit configuration file Files:
Documentation must match implemented behavior.⚙️ CodeRabbit configuration file Files:
**피쳐를 추가, 수정, 삭제할 때 반드시 `README.md`를 함께 업데이트한다.**📄 CodeRabbit inference engine (CLAUDE.md) Files:
Update `docs/development.md` when the change affects📄 CodeRabbit inference engine (docs/documentation-harness.md) Files:
update `README.md`📄 CodeRabbit inference engine (AGENTS.md) Files:
🪛 LanguageTooldocs/development.md[uncategorized] ~19-~19: The official name of this software platform is spelled with a capital “H”. (GITHUB) 🪛 zizmor (1.29.0).github/workflows/build.yml[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 1-18: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 9-18: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) .github/workflows/ci.yml[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 1-17: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 9-17: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) .github/workflows/bot.yml[warning] 1-51: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) .github/workflows/release.yml[warning] 15-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 21-21: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) 🔇 Additional comments (6)
WalkthroughGitHub Actions in four workflows now use immutable commit SHA pins with version comments. The README and development guide document the pinning and maintenance process. ChangesGitHub Actions pinning
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to Workflow actions now use immutable commit pins without changing workflow behavior, and the accompanying maintenance guidance documents how to keep pins synchronized. No merge-blocking current-head risk is evident. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR successfully implements security hardening by pinning all GitHub Actions to immutable commit SHAs, addressing the GITHUB_ACTION_UNPINNED findings from issue #344.
The implementation correctly pins eight action references across four workflow files while retaining version comments for maintainability. The documentation updates in README.md and docs/development.md provide clear maintenance guidance for future action updates.
All workflow files remain syntactically valid, and the PR description confirms validation through make test and make build. The approach follows GitHub Actions security best practices for supply chain protection.
Ready to merge.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
2 participants
Summary
Issue #344's scanner triage identified eight mutable GitHub Action references across the CI, build, release, and issue-bot workflows. Pin them to the current commits behind their existing major-version tags, verified in the official upstream repositories, and retain version comments. Document pin maintenance in the README and development guide.
Workflow triggers, permissions, inputs, scripts, and runtime dependency selection remain unchanged.
Related Issues
Refs #344. This addresses the confirmed
GITHUB_ACTION_UNPINNEDfindings only; the issue remains open for scanner CI and the existing upstream listing submission's remaining follow-up.Validation
make testpassed.make buildpassed for bothunicandunic-mcp.origin/main.git diff --checkpassed; complete diff review found no actionable concerns.Checklist
docs/branch-naming-harness.mddocs/documentation-harness.md)docs/pages updated if architecture, auth, config, or workflow changedSummary by CodeRabbit
Security
Documentation